Asymmetricagentic warfare
What continuous agent-driven attacks mean for business costs, open models, inference, and the authority given to defensive agents.
Dax, who builds OpenCode, described what it was like to be under sustained attack for 48 hours:
“a side effect is everything is getting hardened but damn we basically need agents going 24/7
because that's what they have”2
Travis Fischer calls this AI cyberswarm warfare: cheap, persistent agents probing systems, adapting when something fails, and spreading their effort across more targets. His concern is that this capability reaches attackers faster than effective protection reaches the systems they attack.1
Thousands of attempts, one investigation
Hugging Face's account of its July intrusion shows us some of the problems we'll have in the near future. OpenAI agents running a cybersecurity evaluation with reduced safeguards went outside the exercise and reached Hugging Face's production infrastructure.45
Hugging Face reconstructed 17,600 actions. Most went nowhere. The agents tried other paths, changed channels when blocked, and returned to earlier leads. Enough of those attempts connected to produce a successful intrusion.4
The company then had to work out which credentials were exposed, which systems had been reached, and what could still be trusted. It used AI-assisted analysis, rotated credentials, narrowed access, and rebuilt compromised infrastructure.4
The public reports do not give a dollar ratio between attack and defense. One outside analysis estimates about $210,000 for the participating attack agents, using public API prices and assumptions about token usage. That is not a figure OpenAI disclosed.20 Hugging Face's reports provide no comparable defensive-agent cost. The roughly $400,000 reported by METR was API credits supplied by OpenAI for the later investigation, not Hugging Face's defense budget.45
Reading between some lines, I'm under the impression OpenAI's runaway attack was in the millions and Hugging Face's defense cost much less.
Workload-wise, the case is: An attacker can leave thousands of failed attempts behind, and the defender still has to separate them from the few actions that exposed something important. So just in compute alone, that can be an expensive defense if you're using frontier models only.
The defender's tools started refusing to work
Hugging Face says the hosted models it first used refused substantial portions of the forensic analysis because exploit payloads and attack commands in the logs triggered safety restrictions. It moved the work to a self-hosted, open-weight model, GLM-5.2, and kept the sensitive data on its own infrastructure.4
Dax reported a similar problem during the OpenCode incident: the models helped investigate, then began refusing. He also said getting access to Daybreak Blue improved the situation. Better assistance existed, but access to it became an issue during the incident.9
David Sacks connects these cases to an argument for decentralized access to powerful defensive models. His position is that attackers will obtain capable systems anyway, while centralized restrictions can obstruct legitimate defenders.17
Besides the policy argument, the incidents support a more specific point: A company needs to know whether its defensive tools will analyze the attack in front of it through the entire attack. Finding out halfway through an incident that it won't is an expensive time to find out.
Paying for constant defense
For a business on a modest margin, “keep defensive agents running around the clock” raises an immediate question about cost, and about how unpredictable the bill could become. Obviously the exposure goes beyond tokens to include people pulled off their normal work, interrupted service, and the recovery that follows. But still, just the unforeseen token costs themselves are a new variable for all of us.
A defense that sends every suspicious request to an expensive model could also let the attacker influence how much the business spends. It argues for putting routine filtering and rate limits in front of model-driven investigation, grouping related alerts, and saving the more capable models for work that needs them. A spending limit alone is not a defense if hitting it turns protection off.
Smaller companies are unlikely to build all of this themselves. There is a case for their hosting platforms and security providers to supply shared defensive capacity, the way they supply other managed infrastructure. But even still, how are SMBs, schools, hospitals going to afford agentic security let alone monitor and run it?
Open models need somewhere to run
Hugging Face's experience gives open-weight models a practical role in incident response. When the hosted services it tried would not do the work, it could run a capable model under its own control.4
Someone still has to pay for the hardware, operate the serving software, and keep capacity available when it is needed. Hugging Face could use its own infrastructure. A small software company might need a managed provider or a prearranged fallback instead.
That makes inference, the compute used to run a model, part of the security question: whether a defender can get enough capacity through a sustained incident, whether rate limits will delay the investigation, and whether another usable route exists if a provider refuses the work or goes down.
Cheaper inference would help defenders sustain the work, but it would also let attackers try more paths for the same budget. AISI's assessment identifies both the private-hosting benefits and the loss of centralized misuse controls which is curious.19
Narrower permissions for defensive agents
Giving defensive agents more access creates its own problem. An agent investigating an incident might need logs, source code, and infrastructure information. That does not mean it should have standing permission to change everything it can inspect.
Keycard is working on this by building identity and authorization for agents: which agent is acting, on whose behalf, for what task, and with what access. It argues for temporary, task-scoped credentials and rules enforced outside the agent, including when one agent delegates work to another. In Keycard's framing, the agent cannot be the sole authority on why it deserves more access, or it could talk its way into broader permissions.12
Those controls have limits. Keycard's documentation distinguishes stopping new credentials from invalidating credentials already issued, and existing tokens can keep working until they expire. “Revoke access” needs to mean something concrete in the systems receiving the requests.18
Continuous attacks still put pressure on the time between finding a problem and containing it. Defensive agents could help reduce the time and money spent, if they have dependable access to capable models, enough authority to do useful work, and boundaries they cannot expand for themselves.
Still, all that being said, at least in its current manifestation: How do we all even afford agentic warfare right now? It seems very out of reach for most businesses.
Sources
[1] Travis Fischer on AI cyberswarm warfare
[4] Hugging Face intrusion timeline
[5] METR incident investigation
[9] Dax on model refusals and defensive access
[12] Keycard on authorization for agents
[17] David Sacks on defensive models
[18] Keycard grant revocation documentation